Here is how we removed all 200 entries in the haproxy.log. Simply added this line to /etc/rsyslog.conf:   if ($programname == "haproxy" and not ($msg contains " 200 ")) then /var/log/haproxy.log       ... View more

dear Hgrow, This idea mekes sense to you. can you please help me to achieve this. furthermore can I expand this to f5. ... View more

Hi toledotiago, the input you opened is Splunk-TCP input to receive data from a Splunk Universal Forwarder in Splunk’s internal format, not any arbitrary tcp source. Take a look at https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Monitornetworkports for the tcp/udp input you are looking for. If you are dealing with syslog i highly recommend this blog: http://www.georgestarcher.com/splunk-success-with-syslog/ Sincerely hgrow ... View more

saved my day. thank you ! ... View more

Hi there, while installing a universal forwarder did you configured the deployment server on your forwarder? Thats the step telling your forwarder about your splunk server. You can check: http://docs.splunk.com/Documentation/Splunk/6.5.2/Updating/Configuredeploymentclients If you did that, a problem can be a firewall between your universal forwarder and you splunk server, blocking the traffic when the UF phones home to the Deployment Server. Edit: From the Universal Forwarder Documentation: https://docs.splunk.com/Documentation/Forwarder/6.5.2/Forwarder/Configuretheuniversalforwarder#Configure_the_universal_forwarder_to_connect_to_a_deployment_server After that the forwarder must appear as a client in splunk under Settings -> Forwarder Management -> Clients Greetings ... View more

Currently, this stanza exists inside /opt/splunk/etc/apps/search/local/inputs.conf (I inherited this Splunk environment). Would I need to remove it so that the /opt/splunk/etc/apps/search/local/transforms.conf and /opt/splunk/etc/apps/search/local/props.conf can properly set the index, sourcetype or can I leave it as is? In other words, will transforms.conf and props.conf override the inputs.conf file? [udp://514] connection_host = dns sourcetype = access_combined index = network ... View more

Hi maryang, execute the following search in splunk: | makeresults | eval msgId="abc-" | rex field=msgId "(?<name_your_field>.*)-" Your regex is not quite right. Your capturing group must be a so called "naming group" Next . just referes to any character except line break but just once. you want any character until a - . By following your approch you will add * (zero or more times) to the . . A maybe little bit better approach might be to capture everything from the beginning of the line which is not a - : | makeresults | eval msgId="abc-" | rex field=msgId "(?<name_your_field>^[^-]+)-" Sincerely, hgrow ... View more

as far as I remember, dest_nt_domain is defined in a transforms.conf. REGEX could be modified to avoid parting "-" by creating a transforms.conf in local directory, I guess. ... View more

Thank you everyone! It worked out perfectly! I used this document to create the app that would allow the deployment server to tell the Forwarder which data to collect and which index to send it to: http://docs.splunk.com/Documentation/Splunk/6.5.0/Updating/Extendedexampledeployseveralstandardforwarders ... View more

@kc64645 plase download mongodb_unityjdbc_full.jar, https://raw.githubusercontent.com/michaelloliveira/traccar-mongodb/master/lib/mongodb_unityjdbc_full.jar ... View more

You are probably using the same class names in the field alias if you use FIELDALIAS-action = on both only one will work. try something like this: FIELDALIAS-failed_action = action_failed as action1 FIELDALIAS-success_action = action_success as action1 ... View more

I have tried props.conf [hfss_source] TRANSFORMS-set= set_parsing,set_null transforms.conf [set_null] REGEX = standby DEST_KEY = queue FORMAT = nullQueue [set_parsing] REGEX =. DEST_KEY=queue FORMAT=indexQueue Trying to get rid of all entries with the word "standby" in it, but everything gets indexed. splunk cmd btool props list hfss_source shows correctly, but splunk cmd btool transforms list hfss_source shows absolutely nothing Any ideas ? I am completely lost, I feel I have done what everybody is writing will work, but I just can't get it to work? Any help would be greatly appriciated ... View more

So I'm expanding on excellent feedback provided by @hgrow for anyone looking to show the "Original Event" in their own correlations. I think some of the fields above are possibly based on an earlier release of ES. Specifically, I think the use of orig_splunk_server was replaced with orig_indexer_guid to work more consistently across index clustering. The following information is based on my analysis of the embed Javascript logic in the Incident Review dashboard as of Enterprise Security 4.1.1. To see the "Original Event" for a notable, both of the following conditions must be met: The orig_raw field must be provided Either orig_event_hash or orig_cd must be provided. As for the search created by the "View original event" link (drill-down search), the following fields will be used (as provided) to build the search string: orig_time - Used in the base search as _time=VALUE orig_index - Use in the base search as index=VALUE orig_indexer_guid - Used in the filter search as index_guid=VALUE orig_event_hash - Used in the filter search as event_hash=VALUE orig_cd - Used in the filter search as _cd=VALUE Note that in between the base search and the filtering search is the `get_event_id` macro. Without this, the indexer_guid and event_hash fields are not available. ... View more

For versioning : Add the following stanza to app.conf to add your app into the app launcher. Fill out each attribute as described. [launcher] author=<author of app> description=<textual description of app> version=<version of app> For logos : Place app icon images at the following location: $SPLUNK_HOME/etc/apps//static/ with files name using followin rules (appIcon.png,appIcon_2x.png, appLogo.png...) : http://docs.splunk.com/Documentation/Splunk/6.2.5/AdvancedDev/AddConfigurations ... View more

Thanks, just as pwmcity answered, but yours are more visual 🙂 ... View more

Hi Arjan, i've just done the same, but im not able to start the app as a user. Does your user/user-role inherits form other roles? If your user/user-role somehow inherits from the admin-role or gets the admin_all_objects capabilitiy the user will always see the app. To make sure thats not the point check the "Selected capabilities" and the "Imported capabilities" for your user-role. Greetings, hgrow ... View more

I agree with hgrow. I don't think you can have 2 stanzas dealing with the same log source. So instead of using _TCP_ROUTING in inputs, use props and transforms. props.conf (Not sure about the source.) [source::///var/log/mule/.../*] TRANSFORMS-routingto2splunks = log_to_splunk1, log_to_splunk2 transforms.conf [log_to_splunk1] REGEX = . DEST_KEY = _TCP_ROUTING FORMAT = splunk_prod [log_to_splunk2] REGEX = . DEST_KEY = _SYSLOG_ROUTING FORMAT = twd104 ... View more